12,153 reputation
11251
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 2 months
seen yesterday

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Aug
11
reviewed Leave Open Decrypting DES with decrypted and encrypted data
Aug
11
reviewed Approve suggested edit on How does certificate-based encryption solve key revocation problem?
Aug
11
reviewed Reviewed Verify Messages to Embedded Device
Aug
11
revised How does DES decryption work? Is it the same as encryption or the reverse?
copyedit, tags
Aug
9
reviewed Close Learning to encrypt/encryption algorithms
Aug
9
reviewed Close Jumblar: Using map locations as passwords
Aug
9
reviewed Leave Open Alice's forgetful banking
Aug
9
reviewed Leave Open Is this an acceptable authenticated encryption?
Aug
9
comment How to supply the GCM authentication tag to the OpenSSL command line tools?
The auth_tag parameter actually has nothing to do with associated data; that's what the (confusingly similar-named) auth_data parameter is for.
Aug
9
awarded  Custodian
Aug
9
reviewed Reviewed How to supply the GCM authentication tag to the OpenSSL command line tools?
Aug
9
revised How to supply the GCM authentication tag to the OpenSSL command line tools?
copyedit, more specific title, tags; ps. welcome to crypto.SE
Aug
9
comment Does impersonating an SRP server give you enough information for an off-line dictionary attack?
Ps. This question is related, but asks about an attack scenario where the attacker knows the verifier $v$, e.g. because they've compromised a legitimate server. My question is about the case where the attacker does not know $v$, but can otherwise impersonate a legit server to the client.
Aug
9
comment Alice's forgetful banking
@CodesInChaos: I think I see what you mean now: the client's proof of knowing the password is a value that depends only on the password and on values known by the (fake) server, so once the server has it they can run a dictionary attack on it. What's confusing me is that there's a section in the 1998 SRP paper that seems to say that including $v$ in the calculation of $B$ somehow averts this attack (although I don't really see how, since the fake server can just pick a random $B$). It's confusing me enough that I asked a separate question about it.
Aug
9
asked Does impersonating an SRP server give you enough information for an off-line dictionary attack?
Aug
9
comment Alice's forgetful banking
@Nick: I gave some reasons in this answer, but the real problem in your scenario is that, with a combined account identifier/authenticator, you have no way of referring to the account without also disclosing the information needed to access it. (As for your second question, I'd say the optimal choice would be to use $M$ bits for identification and $N-M$ bits for authentication, where $M$ is the minimum number of bits needed to uniquely identify the user.)
Aug
9
comment Alice's forgetful banking
@CodesInChaos: Wait, how does that work? Maybe I'm missing something simple, but I can't see any obvious way for a fake server to obtain the user's verifier from an SRP authentication attempt. Explain? (Anyway, a good way to mitigate such issues in practice is to use a key stretching KDF such as PBKDF2 to hash the password. That's a useful precaution anyway, in case a legitimate server gets compromised. The iteration count should generally be chosen so that the hashing process takes about 0.1 to 1 seconds on a typical client.)
Aug
9
answered Alice's forgetful banking
Aug
9
revised AES plaintext is smaller than 128 bits - how to expand?
copyedit, fix spelling in title
Aug
9
revised Any problems with this secure time synchronization scheme?
edited tags